EU Trusted List (EUTL)
Definition
The authoritative list maintained by the European Commission listing all Trust Service Providers per EU member state that are supervised to issue qualified certificates, qualified timestamps, or other qualified trust services. Used to establish whether a claimed QES certificate was issued by an authorised TSP.
- Maintained by
- European Commission
- Content
- Trust Service Providers per EU member state
- Services covered
- Qualified certificates, qualified timestamps, other qualified trust services
- Forensic use
- Verifying whether a claimed QES certificate is authorised
Common questions
How does an investigator use the EUTL to verify a Qualified Electronic Signature?+
They check whether the certificate authority that issued the claimed QES certificate appears as a supervised Trust Service Provider on the relevant member state's Trusted List, since a certificate from an unlisted provider cannot carry the QES legal presumption regardless of its technical form.
Does the absence of a provider from the EUTL prove a signature is fraudulent?+
No, it means the signature cannot claim the highest eIDAS tier, Qualified Electronic Signature status, but the signature may still be a valid Advanced or Simple electronic signature under other legal grounds.
Is the EUTL a single EU-wide list or separate per country?+
It aggregates each member state's national Trusted List into one machine-readable and human-browsable EU-wide resource, so a checker does not need to consult 27 separate national sources individually.
Related terms
- Aadhaar E-Sign
- India's authentication-linked electronic signature service in which the user's Aadhaar biometric or OTP authentication triggers the generation of a short-validity signing certificate...
- ESIGN Act (Electronic Signatures in Global and National Commerce Act)
- US federal legislation (2000) providing that no electronic signature may be denied legal effect solely because it is in electronic form. Technology-neutral:...
- Long-Term Validation (LTV)
- A PDF signature profile (PAdES-LTV, ETSI EN 319 102-1) in which the OCSP responses, CRL data, and TSA certificate chain information are...
- OCSP (Online Certificate Status Protocol)
- A real-time certificate revocation protocol in which the verifier queries the CA's OCSP responder with the certificate's serial number and receives a...
- Public Key Infrastructure (PKI)
- The system of hardware, software, policies, and standards that manage digital certificates and public-key encryption. Provides the trust architecture underpinning all cryptographic...
- QSCD (Qualified Signature Creation Device)
- A hardware or remote HSM-based device that stores the signer's private key such that it cannot be extracted, ensuring sole control under...
- Qualified Electronic Signature (QES)
- The highest tier of electronic signature under EU eIDAS Regulation 910/2014. Created by a Qualified Signature Creation Device (QSCD), backed by a...
- TSA Timestamp (Timestamp Authority)
- A cryptographically protected record of the time at which a signature was created, issued by a Timestamp Authority (TSA) whose own certificate...
- X.509 Certificate
- A digitally signed data structure that binds a public key to a named identity (subject) and is issued by a Certificate Authority....